@frontmcp/auth 1.8.1 → 1.8.3

package/session/signin-binding.d.ts

@@ -0,0 +1,39 @@
+/** Prefix of the sign-in binding cookie's name; the rest identifies the pending authorization. */
+export declare const SIGNIN_BINDING_COOKIE_PREFIX = "frontmcp_signin_";
+/** Prefix of the binding cookie's name over https (see {@link SigninBindingCookieOptions.secure}). */
+export declare const SIGNIN_BINDING_SECURE_COOKIE_PREFIX = "__Host-frontmcp_signin_";
+/** How the browser reaches the server, which decides the binding cookie's name. */
+export interface SigninBindingCookieOptions {
+    /**
+     * The browser reached the server over https. The cookie is then named
+     * `__Host-frontmcp_signin_…` and must be set `Secure`, with `Path=/` and no
+     * `Domain`; only a cookie of that name counts.
+     */
+    secure?: boolean;
+}
+/**
+ * How long the binding cookie lives, in seconds: long enough for a pending
+ * authorization (10 minutes) followed by a federated session (15 minutes).
+ */
+export declare const SIGNIN_BINDING_MAX_AGE_SECONDS: number;
+/** A new binding: the cookie to give the browser, and the hash to keep server-side. */
+export interface SigninBinding {
+    /** Cookie name, derived from the pending authorization id. */
+    cookieName: string;
+    /** Cookie value: 32 random bytes, base64url. Never stored server-side. */
+    value: string;
+    /** SHA-256 (hex) of `value`, kept on the pending authorization. */
+    hash: string;
+}
+/** The binding cookie's name for the pending authorization `pendingAuthId` (it doesn't carry the id itself). */
+export declare function signinBindingCookieName(pendingAuthId: string, options?: SigninBindingCookieOptions): string;
+/** Create the binding for a new pending authorization. */
+export declare function createSigninBinding(pendingAuthId: string, options?: SigninBindingCookieOptions): SigninBinding;
+/**
+ * Whether a request's `Cookie` header carries the binding of `pendingAuthId`
+ * whose hash is `expectedHash`, under the name `options` selects. Fails closed:
+ * no expected hash (a record created without a binding), no cookie, or a
+ * different value all return `false`.
+ */
+export declare function signinBindingMatches(cookieHeader: string | undefined, pendingAuthId: string, expectedHash: string | undefined, options?: SigninBindingCookieOptions): boolean;
+//# sourceMappingURL=signin-binding.d.ts.map

package/session/signin-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin-binding.d.ts","sourceRoot":"","sources":["../../src/session/signin-binding.ts"],"names":[],"mappings":"AAqBA,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAE/D,sGAAsG;AACtG,eAAO,MAAM,mCAAmC,4BAA2C,CAAC;AAE5F,mFAAmF;AACnF,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,QAAU,CAAC;AAEtD,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,gHAAgH;AAChH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,MAAM,CAG/G;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,aAAa,CAGlH;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAQT"}

package/ui/base-layout.d.ts

@@ -36,6 +36,32 @@ export declare const CDN: {
         readonly stylesheet: "https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap";
     };
 };
+/**
+ * Content-Security-Policy for the built-in authorization pages (sign-in,
+ * consent, provider selection, incremental authorization, errors).
+ *
+ * Scripts may come only from this server and the Tailwind CDN; the pages' own
+ * small inline handlers need `'unsafe-inline'` (every interpolated value is
+ * HTML-escaped). Styles and fonts are limited to Google Fonts, images to this
+ * server, `data:` and https (a client's `logo_uri`), and the pages can't be
+ * framed (clickjacking) or rebased.
+ */
+export declare const BUILT_IN_AUTH_PAGE_CSP: string;
+/**
+ * Security headers for a built-in authorization page.
+ *
+ * `Referrer-Policy: same-origin` keeps the page's URL (client, redirect_uri,
+ * state) away from the CDNs it loads, while the page's own form POST still
+ * carries its `Origin`, which the callback checks; `no-referrer` would turn
+ * that into `Origin: null` and every sign-in would be refused as cross-origin.
+ *
+ * @param options.csp - `false` leaves out the Content-Security-Policy, for
+ *   markup the server didn't write (a `login.render` override may load its own
+ *   scripts); the anti-framing, sniffing, referrer and caching headers still apply.
+ */
+export declare function builtInAuthPageHeaders(options?: {
+    csp?: boolean;
+}): Record<string, string>;
 /**
  * Theme color configuration
  * Keys become CSS custom properties: --color-{key}

package/ui/base-layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-layout.d.ts","sourceRoot":"","sources":["../../src/ui/base-layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAQH;;GAEG;AACH,eAAO,MAAM,GAAG;IACd,oFAAoF;;IAGpF,yCAAyC;;;;;CAKjC,CAAC;AAMX;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mBAAmB;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,WAa3B,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IAEd,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,2CAA2C;IAC3C,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAOD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAsC7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAkE9E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACzC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,MAAM,CAmBzD;AAMD;;GAEG;AACH,eAAO,MAAM,UAAU,YA5BV,MAAM,WAAW,iBAAiB,KAAK,MA8BlD,CAAC;AAEH;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAYtF;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAS9E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CASnF"}
+{"version":3,"file":"base-layout.d.ts","sourceRoot":"","sources":["../../src/ui/base-layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAQH;;GAEG;AACH,eAAO,MAAM,GAAG;IACd,oFAAoF;;IAGpF,yCAAyC;;;;;CAKjC,CAAC;AAEX;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAUvB,CAAC;AAEb;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ9F;AAMD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mBAAmB;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,WAa3B,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IAEd,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,2CAA2C;IAC3C,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAOD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAsC7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAkE9E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACzC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,MAAM,CAmBzD;AAMD;;GAEG;AACH,eAAO,MAAM,UAAU,YA5BV,MAAM,WAAW,iBAAiB,KAAK,MA8BlD,CAAC;AAEH;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAYtF;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAS9E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CASnF"}

package/ui/index.d.ts

@@ -3,9 +3,9 @@
  *
  * Server-side HTML templates for OAuth authorization flows.
  */
-export { CDN, DEFAULT_THEME, baseLayout, createLayout, authLayout, centeredCardLayout, wideLayout, extraWideLayout, escapeHtml, } from './base-layout';
+export { CDN, DEFAULT_THEME, baseLayout, createLayout, authLayout, centeredCardLayout, wideLayout, extraWideLayout, escapeHtml, BUILT_IN_AUTH_PAGE_CSP, builtInAuthPageHeaders, } from './base-layout';
 export type { ThemeColors, ThemeFonts, ThemeConfig, BaseLayoutOptions } from './base-layout';
 export { buildConsentPage, buildIncrementalAuthPage, buildFederatedLoginPage, buildToolConsentPage, buildLoginPage, buildConnectPage, buildConnectSuccessPage, buildErrorPage, renderToHtml, } from './templates';
 export type { AppAuthCard, ProviderCard, ToolCard, LoginExtraField, ConsentHiddenField } from './templates';
-export { renderLocalLoginPage, toLoginExtraFields } from './local-login.helper';
+export { renderLocalLoginPage, toLoginExtraFields, withoutSecretFieldValues } from './local-login.helper';
 //# sourceMappingURL=index.d.ts.map

package/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG7F,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG5G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG7F,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG5G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC"}

package/ui/local-login.helper.d.ts

@@ -16,6 +16,12 @@ import { type LoginExtraField } from './templates';
  * ordered {@link LoginExtraField} array consumed by {@link buildLoginPage}.
  */
 export declare function toLoginExtraFields(fields: LoginConfig['fields'] | undefined, values?: Record<string, string>): LoginExtraField[];
+/**
+ * Drop the submitted values of `password` fields, so a re-rendered sign-in
+ * page never writes a typed secret back into its HTML (where it would sit in
+ * the page source, caches and any logging proxy).
+ */
+export declare function withoutSecretFieldValues(values: Record<string, string> | undefined, fields: LoginConfig['fields'] | undefined): Record<string, string> | undefined;
 /**
  * Render the local login page for the given config + context.
  *
@@ -25,7 +31,8 @@ export declare function toLoginExtraFields(fields: LoginConfig['fields'] | undef
  *
  * @param login  The `auth.login` config (may be undefined).
  * @param ctx    Render context (client identity, scopes, pendingAuthId, callbackPath, error).
- * @param values Optional submitted values to pre-fill on re-render (after a failed authenticate()).
+ * @param submitted Optional submitted values to pre-fill on re-render (after a failed
+ *                  authenticate()). Values of `password` fields are never written back.
  */
-export declare function renderLocalLoginPage(login: LoginConfig | undefined, ctx: LoginRenderContext, values?: Record<string, string>): string;
+export declare function renderLocalLoginPage(login: LoginConfig | undefined, ctx: LoginRenderContext, submitted?: Record<string, string>): string;
 //# sourceMappingURL=local-login.helper.d.ts.map

package/ui/local-login.helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-login.helper.d.ts","sourceRoot":"","sources":["../../src/ui/local-login.helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAS,EACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,eAAe,EAAE,CAWnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,GAAG,EAAE,kBAAkB,EACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAsBR"}
+{"version":3,"file":"local-login.helper.d.ts","sourceRoot":"","sources":["../../src/ui/local-login.helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAS,EACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,eAAe,EAAE,CAWnB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC1C,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAS,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAQpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,GAAG,EAAE,kBAAkB,EACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,MAAM,CAwBR"}

package/ui/templates.d.ts

@@ -110,10 +110,11 @@ export interface ConsentHiddenField {
 /**
  * Build consent page for tool selection.
  *
- * The form GETs/POSTs back to `callbackPath` (`/oauth/callback`) carrying
- * `pending_auth_id`, the chosen `tools=` checkboxes, and any caller-supplied
- * {@link ConsentHiddenField hidden context} (identity / `federated=true` /
- * `providers=`). Honors the `auth.consent` config flags:
+ * The form POSTs back to `callbackPath` (`/oauth/callback`) carrying
+ * `pending_auth_id`, the `csrfToken`, the chosen `tools=` checkboxes, and any
+ * caller-supplied {@link ConsentHiddenField hidden context}. It never needs the
+ * sign-in fields: the verified sign-in stays on the server until consent is
+ * given. Honors the `auth.consent` config flags:
  *
  * - `groupByApp`      — group tools under per-app cards (default) or render a flat list.
  * - `showDescriptions`— show tool descriptions (default) or hide them.

package/ui/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/ui/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAmD,MAAM,eAAe,CAAC;AAM9G;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;GAGG;AACH,eAAO,MAAM,UAAU,uBAAiB,CAAC;AAMzC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAoBT;AA6DD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAsDT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAkFT;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACrC,GAAG,MAAM,CAmLT;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1D,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,GAAG,MAAM,CA2ET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAoCT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAezF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAsBrF;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhF"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/ui/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAmD,MAAM,eAAe,CAAC;AAM9G;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;GAGG;AACH,eAAO,MAAM,UAAU,uBAAiB,CAAC;AAMzC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAoBT;AA6DD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAsDT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAkFT;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACrC,GAAG,MAAM,CAmLT;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1D,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,GAAG,MAAM,CA2ET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAoCT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAezF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAsBrF;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhF"}

package/utils/index.d.ts

@@ -6,4 +6,6 @@ export type { BearerErrorCode, WwwAuthenticateOptions } from './www-authenticate
 export { validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, } from './audience.validator';
 export type { AudienceValidationResult, AudienceValidatorOptions } from './audience.validator';
 export { deriveAuthorizationId } from './authorization-id.utils';
+export { DEFAULT_ALLOWED_SCOPES, grantScopes } from './scope-grant.utils';
+export { isLoopbackRedirectUri } from './redirect-uri.utils';
 //# sourceMappingURL=index.d.ts.map

package/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}

package/utils/redirect-uri.utils.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Redirect-URI helpers shared by the authorization server flows.
+ */
+/**
+ * Whether a redirect_uri targets the loopback interface (localhost, 127.0.0.0/8,
+ * ::1) — the only hosts the default DCR guard accepts when no
+ * `dcr.allowedRedirectUris` allowlist is configured.
+ *
+ * SECURITY: parses with `URL` and matches on the real `hostname`, replacing the
+ * previous unanchored substring regex `^https?://(localhost|\d+\.\d+\.\d+\.\d+|127\.0\.0\.1)`
+ * which accepted attacker hosts such as `http://localhost.evil.com/cb`,
+ * `http://1.2.3.4.evil.com/cb`, and — via userinfo — `http://127.0.0.1@evil.com/cb`
+ * (whose real host is `evil.com`). Any userinfo component is rejected outright.
+ */
+export declare function isLoopbackRedirectUri(uri: string): boolean;
+//# sourceMappingURL=redirect-uri.utils.d.ts.map

package/utils/redirect-uri.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.utils.d.ts","sourceRoot":"","sources":["../../src/utils/redirect-uri.utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkB1D"}

package/utils/scope-grant.utils.d.ts

@@ -0,0 +1,11 @@
+/** The scopes granted when `allowedScopes` is not configured: the standard OpenID Connect ones. */
+export declare const DEFAULT_ALLOWED_SCOPES: readonly string[];
+/**
+ * Keep the requested scopes that match an allowed entry (exact, or a `*` glob),
+ * in request order, without duplicates.
+ *
+ * @param requested The scopes the client asked for.
+ * @param allowed   The configured allowlist; `undefined` means {@link DEFAULT_ALLOWED_SCOPES}.
+ */
+export declare function grantScopes(requested: readonly string[], allowed: readonly string[] | undefined): string[];
+//# sourceMappingURL=scope-grant.utils.d.ts.map

package/utils/scope-grant.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-grant.utils.d.ts","sourceRoot":"","sources":["../../src/utils/scope-grant.utils.ts"],"names":[],"mappings":"AASA,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAQ1G"}